Loading story…
Cybercriminals are increasingly targeting identity credentials rather than exploiting software vulnerabilities, fueling a thriving underground market for stolen usernames, passwords, tokens, and access rights. This so-called 'identity economy' has become a central pillar of the cybercrime ecosystem, with credentials being traded much like commodities on illicit marketplaces. Financial services and healthcare organizations remain prime targets, but the threat is universal, as evidenced by a 2023 study indicating that 95% of enterprises experienced some form of identity fraud. The financial impact is significant, with banks losing an average of $310,000 per incident and high-profile breaches, such as the $1.5 billion theft from a cryptocurrency exchange by North Korean hackers, underscoring the scale of the problem. Attackers employ a mix of traditional and modern techniques, including phishing, man-in-the-middle attacks, session hijacking, and social engineering, with AI now making phishing attempts more convincing and attacks more efficient. The rise of AI has supercharged these traditional attacks, enabling threat actors to accelerate reconnaissance and discovery phases by up to tenfold. AI is also being weaponized in new ways, such as compromising organizations' own AI instances to exfiltrate sensitive data or subvert security defenses, a tactic likened to 'living-off-the-land' but with AI agents. The cybercrime-as-a-service model further lowers the barrier to entry, allowing even less sophisticated actors to launch credential stuffing, fraudulent registration, and synthetic identity attacks at scale. To counter these evolving threats, experts emphasize the need for robust identity controls, particularly for managing access by both human users and AI agents. Industry leaders advocate for open standards, such as the draft Cross App Access extension to OAuth, which aims to provide centralized, standardized authorization for AI-driven and app-to-app interactions. The IPSIE working group and protocols like MCP and A2A are also working to establish consistent identity security profiles and authentication frameworks to safely manage AI agents' access and communication. With quantum computing on the horizon, the long-term value of stolen credentials is expected to rise, as encrypted data from past breaches could eventually be decrypted, turning old compromises into renewed threats. Multi-factor authentication (MFA) remains a critical defense, but attackers are adapting with tactics like MFA fatigue, where users are bombarded with prompts until they approve access. Insiders continue to pose risks, and the combination of human error and advanced AI-driven attacks makes comprehensive identity security more urgent than ever. The consensus among security professionals is that industry alignment on open standards and the implementation of strict access controls are essential to securing the future of digital identity in an AI-driven threat landscape.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations across industries are experiencing a surge in identity-related breaches, with attackers exploiting weaknesses in authentication systems and leveraging advanced phishing techniques. Despite years of investment in stronger access controls, many companies continue to rely on passwords, which remain a primary entry point for cybercriminals. Password reuse, weak verification processes, and overconfidence in outdated systems contribute to the persistence of these breaches. Attackers often gain initial access through compromised credentials and can move laterally within networks for extended periods before detection. Social engineering tactics, such as convincing help desk staff to reset passwords or bypass multi-factor authentication, have become increasingly effective, as support teams are typically trained to assist rather than scrutinize user legitimacy. Most organizations have not implemented robust identity verification for support interactions, relying instead on easily compromised methods like security questions and one-time codes. The adoption of passwordless authentication remains low, and where it is higher, organizations report fewer identity-related breaches and losses. Meanwhile, phishing remains a dominant vector for malware delivery, with attackers using email to introduce ransomware, spyware, and other malicious software into business networks. AI-powered phishing campaigns are on the rise, with cybercriminals using generative tools to craft highly personalized and convincing messages that evade traditional detection methods. These AI-enhanced attacks can be launched at scale, targeting entire organizations rapidly and making it more difficult for employees to distinguish legitimate communications from malicious ones. The evolution of AI in cybercrime has also led to the proliferation of synthetic fraud, deepfake scams, and autonomous fraud campaigns that operate continuously. Despite the growing threat, only a minority of businesses have adopted AI-driven defenses, even as the majority of leaders recognize AI-generated fraud as a top challenge in the near future. The gap between the sophistication of attacker tactics and the defensive capabilities of organizations is widening, with operational damage and financial losses mounting as a result. Security teams face challenges in modernizing identity controls across diverse environments, including legacy systems that are incompatible with newer authentication methods. The need for comprehensive, adaptive security strategies that incorporate AI-powered detection and response is becoming increasingly urgent as adversaries continue to innovate. Organizations are urged to strengthen identity verification processes, accelerate the adoption of passwordless technologies, and invest in AI-driven security solutions to counter the escalating threat landscape. The convergence of identity-related breaches and AI-enhanced phishing underscores the critical importance of proactive, multi-layered defenses in protecting against modern cyberattacks.
Jul 12, 2026
Recent analyses highlight that the most significant cybersecurity losses in 2025 stemmed from identity and OAuth token abuse, rather than high-profile zero-day vulnerabilities. Attackers leveraged AI to scale social engineering, phishing, and OAuth consent abuse, leading to widespread incidents across logistics, manufacturing, and other sectors. The rapid adoption of AI in enterprise environments has expanded the attack surface, with 99% of surveyed organizations experiencing at least one attack on their AI systems in the past year. The proliferation of GenAI-assisted coding has further outpaced security teams’ ability to secure production environments, compounding risk. Security leaders are increasingly concerned about the misalignment between teams, tools, and workflows, which exacerbates the impact of these AI-driven threats. Effective management of non-human identities (NHIs), such as machine credentials and tokens, is now critical, especially in cloud and SaaS environments. The need for robust governance, visibility, and context-aware controls is underscored by the growing sophistication of attacks targeting both human and machine identities. Organizations are urged to prioritize identity and secrets management, as well as to adapt their security strategies to address the evolving risks introduced by AI and automation.
Jun 29, 2026
CISOs are fundamentally rethinking their security organizations as artificial intelligence becomes deeply integrated into business strategies and cybersecurity operations. According to a Deloitte survey, 43% of US cyber decision-makers are already leveraging AI extensively within their cybersecurity programs, which is gradually increasing the influence of CISOs in strategic technology investment discussions. While AI has not yet revolutionized security organizations, it is steadily reshaping operational models, with speed and adaptability becoming critical factors for both defense and attack. Security leaders emphasize that AI accelerates all aspects of cybersecurity, magnifying the impact of both strong and weak security fundamentals, such as provisioning, permissions, and network segmentation. Organizations with mature security postures are realizing efficiencies by layering AI-driven tools into their workflows, while those lacking foundational controls face amplified risks. At industry events like Oktane 2025, experts highlighted that identity has become the new frontline in protecting AI-driven enterprises, as the proliferation of SaaS and AI agents leads to a surge in both human and non-human identities. This identity explosion introduces new risks, including misconfigured access, orphaned accounts, and sophisticated identity-based attacks. Security teams are adopting open standards such as IPSIE, MCP, and A2A to build secure, interoperable AI ecosystems and maintain centralized control over AI-driven interactions. Companies like Adyen have demonstrated success in unifying identity management across global operations, improving both security and user experience. Embedding AI into workflows, as seen at Box, enhances data protection even in highly regulated industries. Security practitioners are also focusing on behavioral monitoring, automation, and fostering a security-first culture to counter attackers who increasingly exploit identity systems rather than traditional hacking methods. The rise of AI-driven social engineering, including deepfakes and multi-channel phishing, is prompting organizations to implement phishing-resistant multi-factor authentication, zero-trust architectures, and comprehensive employee training. The convergence of AI and identity management is shaping the future of enterprise security, requiring a blend of advanced technology, disciplined fundamentals, and adaptive strategies to address evolving threats.
Jul 12, 2026